First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect hardcoded address in `Deploy::run` function

bube

Summary

There is an inconsistency in the token address used for the USDC token on the zkSync network in the Deploy.s.sol scipt. The s_zkSyncUSDC state variable is declared with one address, but a different address is hardcoded in the Deploy::run function when transferring USDC to the MerkleAirdrop contract.

Vulnerability Details

In the Deploy script the s_zkSyncUSDC address is declared as 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4.
But within the Deploy::run function, there is a hardcoded address 0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4 that is used in the transfer call. The problem is that the s_zkSyncUSDC address is not the same as the hardcoded address:

​
contract Deploy is Script {
@> address public s_zkSyncUSDC = 0x1D17CbCf0D6d143135be902365d2e5E2a16538d4;
bytes32 public s_merkleRoot = 0xf69aaa25bd4dd10deb2ccd8235266f7cc815f6e9d539e9f4d47cae16e0c36a05;
// 4 users, 25 USDC each
uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
​
// Deploy the airdropper
function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
@> IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
​

Impact

The airdrop address will be not able to receive the required amount of USDC due to the wrong hardcoded address used in the Deploy::run function. This leads to unsuccessful deploy of the protocol and inability of the protocol to function properly.

Tools Used

Manual Review

Recommendations

Replace the hardcoded address in the Deploy::run function with the s_zkSyncUSDC variable to ensure the intended address is used for the transfer of the required USDC amount to the airdrop address:

​
function run() public {
vm.startBroadcast();
MerkleAirdrop airdrop = deployMerkleDropper(s_merkleRoot, IERC20(s_zkSyncUSDC));
// Send USDC -> Merkle Air Dropper
+ IERC20(s_zkSyncUSDC).transfer(address(airdrop), s_amountToAirdrop);
- IERC20(0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4).transfer(address(airdrop), s_amountToAirdrop);
vm.stopBroadcast();
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

usdc-wrong-address

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.